New York Department of Financial Services · July 14, 2026 · Primary source
Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment
Summary
The New York Department of Financial Services issued an industry letter dated May 21, 2026, providing guidance to all DFS-regulated organizations and individuals on cybersecurity measures to adopt in a heightened threat environment. The letter addresses DFS-regulated entities broadly, which include health insurers and managed care organizations subject to DFS oversight, and recommends specific defensive measures without amending the existing DFS Cybersecurity Regulation (23 NYCRR 500). The guidance supplements existing regulatory requirements rather than creating new binding mandates.
What this may mean
DFS-regulated entities, including health insurers and managed care organizations licensed in New York, receive non-binding but agency-issued guidance specifying cybersecurity controls to implement in the current threat environment. While the letter does not create new regulatory obligations, DFS-regulated entities that experience a cyber incident without having adopted the recommended measures may face heightened scrutiny under the existing 23 NYCRR 500 framework during any post-incident examination.
Informational only. Not legal, medical, financial, or other professional advice. Always consult a qualified professional familiar with your specific facts before relying on any item.
Related items
- New York Department of Financial Services · September 5, 2026Department of Financial Services Announces 2027 Health Insurance Premium Rates, Saving New Yorkers $1.6 BillionScore 56
- New York Department of Financial Services · August 12, 2026Cybersecurity Alert: N-central Vulnerability Affecting Some Managed Service ProvidersScore 55
- New York Department of Financial Services · September 10, 2026Guidance on How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity RegulationScore 48
- New York Department of Financial Services · August 17, 2026Cybersecurity Alert: N-central Vulnerability Affecting Some Managed Service ProvidersScore 46
- New York Department of Financial Services · September 10, 2026DFS Issues New Cybersecurity Guidance on Risk Assessments for Financial Services EntitiesScore 43
- New York Department of Financial Services · August 14, 2026New York State Department of Financial Services Introduces Guidance and Proposed Regulation to Strengthen New York’s Surprise Medical Bill Resolution ProcessScore 31